A security flaw in the edit_member.php script of ProjectWorlds Advanced Library Management System allows an attacker to manipulate the firstname, middlename, lastname, address, branch, and type parameters to inject arbitrary SQL statements. The injection can alter, delete, or expose data in the underlying database, resulting in compromise of confidentiality, integrity, and potentially availability of library member information. The weakness is a classic SQL injection, classified under CWE-89 and CWE-74.

ProjectWorlds Advanced Library Management System version 1.0, specifically the edit_member.php page that manages member records. The vulnerability applies to any installation of this version, as indicated by the CPE string for the product.

The CVSS vector lists a score of 5.1, reflecting a moderate level of risk. No EPSS score is reported, and the vulnerability is not included in CISA’s KEV catalog. However, exploits are publicly available, and the attack can be performed remotely by sending crafted HTTP requests to the vulnerable endpoint. This suggests that an unauthenticated attacker could achieve data exfiltration or modification within a reasonable time frame. Given the moderate severity rating and public availability of the exploit, the overall risk remains significant for unpatched deployments.